The Kali Linux kernel differs slightly from the “usual” kernel. For the purposes of penetration testing, we chose to use some defaults that differ from general-purpose Linux distributions, and we also patch the kernel here and there. This page will document these changes.

Beside each header will call out if the configuration is a kernel patch or if the behavior was modified by sysctl. If you would like to explore these kernel patches for yourself, you can find them here, on our GitLab.

We supply a WiFi injection patch to help with WiFi-based penetration testing.

The kernel logs are unrestricted by default, meaning that any unprivileged user can run the command dmesg and inspect the kernel logs (also called the “kernel ring buffer”). If you would prefer dmesg to remain a privileged command, you can use kali-tweaks to restore this behavior.

Traditionally, IPv4 ports below 1024 are called “privileged ports,” and can only be used by the privileged user. In Kali Linux, this is disabled by default, meaning that all ports are “unprivileged,” or in other words any user can run a program that binds to any port, even below 1024.

This was done as Kali is no longer root user by default, and with a non-root user some tools, such as netcat or Metasploit, may be trying to use ports that would require privilege. This should cut-down on the need to run sudo as often. If you would like to leave ports 1024 and below as privileged, this can be done through kali-tweaks.

• Enable sniffer mode for carl9170 cards
• Adds touchscreen support for Odroid VU7 devices